In this article we will just show pictures and a video of how you might analyze the imported PCAP dumps using Trisul.

This is Part-3 of a 3 Part series

• Part 1: Approach how to avoid getting overwhelmed by large PCAPS
• Part 2: How to use the free TrisulNSM Docker Image to analyze the PCAP dump
• Part 3: Screenshots & video of analysis paths (using TrisulNSM)

Now lets see some screenshots that will give you an idea of where to start.

A sample video made by one of our engineers showing the analysis paths.

Here are a few screenshots of the dataset showing the monitoring and baseline building techniques described in Part-1 of this series

Select a timeframe and then view 100s of metrics

Here we are seeing the JA3 TLS Fingerprints

Here we are seeing the JA3 TLS Fingerprints, building a baseline model

DOCKER:unpl:root savedfiles$ ls /tmp/savedfiles/*.exe -l
-rw-r--r-- 1 trisul trisul   287392 May 11 12:52 /tmp/savedfiles/00_00_f91a_10.128.0.201__PsGetsid.exe
-rw-r--r-- 1 trisul trisul   287392 May 11 12:52 /tmp/savedfiles/00_00_fb80_10.128.0.201__PsGetsid.exe
-rw-r--r-- 1 trisul trisul 12582912 May 11 12:52 /tmp/savedfiles/00_01_dbcf_10.150.0.70__chocolate_debug.exe
-rw-r--r-- 1 trisul trisul 42846720 May 11 12:52 /tmp/savedfiles/00_01_df63_10.150.0.70__chocolate_debug.exe
DOCKER:unpl:root savedfiles$